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APPENDIX F: MONEY LAUNDERING AND 
TERRORIST FINANCING "RED FLAGS" 


The following are examples of potentially suspicious activities, or "red flags" for both money 
laundering and terrorist financing. Although these lists are not all-inclusive, they may help banks 
and examiners recognize possible money laundering and terrorist financing schemes. FinCEN issues 
advisories containing examples of "red flags" to inform and assist banks in reporting instances of 
suspected money laundering, terrorist financing, and fraud. In order to assist law enforcement in its 
efforts to target these activities, FinCEN requests that banks check the appropriate box(es) in the 
Suspicious Activity Information section and include certain key terms in the narrative section of the 
SAR. The advisories and guidance can be found on FinCEN's website . 302 Management's primary 
focus should be on reporting suspicious activities, rather than on determining whether the 
transactions are in fact linked to money laundering, terrorist financing, or a particular crime. 

The following examples are red flags that, when encountered, may warrant additional scrutiny. The 
mere presence of a red flag is not by itself evidence of criminal activity. Closer scrutiny should help 
to determine whether the activity is suspicious or one for which there does not appear to be a 
reasonable business or legal purpose. 

Potentially Suspicious Activity That May Indicate Money Laundering 
Customers Who Provide Insufficient or Suspicious Information 

• A customer uses unusual or suspicious identification documents that cannot be readily 
verified. 

• A customer provides an individual taxpayer identification number after having previously used 
a Social Security number. 

• A customer uses different taxpayer identification numbers with variations of his or her name. 

• A business is reluctant, when establishing a new account, to provide complete information 
about the nature and purpose of its business, anticipated account activity, prior banking 
relationships, the names of its officers and directors, or information on its business location. 

• A customer's home or business telephone is disconnected. 

• The customer's background differs from that which would be expected on the basis of his or 
her business activities. 
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• A customer makes frequent or large transactions and has no record of past or present 
employment experience. 

• A customer is a trust, shell company, or Private Investment Company that is reluctant to 
provide information on controlling parties and underlying beneficiaries. Beneficial owners may 
hire nominee incorporation services to establish shell companies and open bank accounts for 
those shell companies while shielding the owner's identity. 

Efforts to Avoid Reportin g or Recordkeepin g Requirement 

• A customer or group tries to persuade a bank employee not to file required reports or maintain 
required records. 

• A customer is reluctant to provide information needed to file a mandatory report, to have the 
report filed, or to proceed with a transaction after being informed that the report must be 
filed. 

• A customer is reluctant to furnish identification when purchasing negotiable instruments in 
recordable amounts. 

• A business or customer asks to be exempted from reporting or recordkeeping requirements. 

• A person customarily uses the automated teller machine to make several bank deposits below 
a specified threshold. 

• A customer deposits funds into several accounts, usually in amounts of less than $3,000, 
which are subsequently consolidated into a master account and transferred outside of the 
country, particularly to or through a location of specific concern (e.g., countries designated by 
national authorities and Financial Action Task Force on Money Laundering (FATF) as 
noncooperative countries and territories). 

• A customer accesses a safe deposit box after completing a transaction involving a large 
withdrawal of currency, or accesses a safe deposit box before making currency deposits 
structured at or just under $10,000, to evade CTR filing requirements. 

Funds Transfers 


• Many funds transfers are sent in large, round dollar, hundred dollar, or thousand dollar 
amounts. 

• Funds transfer activity occurs to or from a financial secrecy haven, or to or from a higher-risk 
geographic location without an apparent business reason or when the activity is inconsistent 
with the customer's business or history. 

• Funds transfer activity occurs to or from a financial institution located in a higher risk 
jurisdiction distant from the customer's operations. 

• Many small, incoming transfers of funds are received, or deposits are made using checks and 
money orders. Almost immediately, all or most of the transfers or deposits are wired to 
another city or country in a manner inconsistent with the customer's business or history. 

• Large, incoming funds transfers are received on behalf of a foreign client, with little or no 
explicit reason. 

• Funds transfer activity is unexplained, repetitive, or shows unusual patterns. 

• Payments or receipts with no apparent links to legitimate contracts, goods, or services are 
received. 

• Funds transfers are sent or received from the same person to or from different accounts. 

• Funds transfers contain limited content and lack related party information. 

Automated Clearin g House Transactions 

• Large-value, automated clearing house (ACH) transactions are frequently initiated through 
third-party service providers (TPSP) by originators that are not bank customers and for which 
the bank has no or insufficient due diligence. 

• TPSPs have a history of violating ACH network rules or generating illegal transactions, or 
processing manipulated or fraudulent transactions on behalf of their customers. 

• Multiple layers of TPSPs that appear to be unnecessarily involved in transactions. 
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• Unusually high level of transactions initiated over the Internet or by telephone. 

• NACHA — The Electronic Payments Association (NACHA) information requests indicate 
potential concerns with the bank's usage of the ACH system. 

Activity Inconsistent with the Customer's Business 

• The currency transaction patterns of a business show a sudden change inconsistent with 
normal activities. 

• A large volume of cashier's checks, money orders, or funds transfers is deposited into, or 
purchased through, an account when the nature of the accountholder's business would not 
appear to justify such activity. 

• A retail business has dramatically different patterns of currency deposits from similar 
businesses in the same general location. 

• Unusual transfers of funds occur among related accounts or among accounts that involve the 
same or related principals. 

• The owner of both a retail business and a check-cashing service does not ask for currency 
when depositing checks, possibly indicating the availability of another source of currency. 

• Goods or services purchased by the business do not match the customer's stated line of 
business. 

• Payments for goods or services are made by checks, money orders, or bank drafts not drawn 
from the account of the entity that made the purchase. 

Lendin g Activity 

• Loans secured by pledged assets held by third parties unrelated to the borrower. 

• Loan secured by deposits or other readily marketable assets, such as securities, particularly 
when owned by apparently unrelated third parties. 

• Borrower defaults on a cash-secured loan or any loan that is secured by assets which are 
readily convertible into currency. 

• Loans are made for, or are paid on behalf of, a third party with no reasonable explanation. 

• To secure a loan, the customer purchases a certificate of deposit using an unknown source of 
funds, particularly when funds are provided via currency or multiple monetary instruments. 

• Loans that lack a legitimate business purpose, provide the bank with significant fees for 
assuming little or no risk, or tend to obscure the movement of funds (e.g., loans made to a 
borrower and immediately sold to an entity related to the borrower). 

Chan g es in Bank-to-Bank Transactions 

• The size and frequency of currency deposits increases rapidly with no corresponding increase 
in noncurrency deposits. 

• A bank is unable to track the true accountholder of correspondent or concentration account 
transactions. 

• The turnover in large-denomination bills is significant and appears uncharacteristic, given the 
bank's location. 

• Changes in currency-shipment patterns between correspondent banks are significant. 

Cross-Border Financial Institution Transactions 


• U.S. bank increases sales or exchanges of large denomination U.S. bank notes to Mexican 
financial institution(s). 

• Large volumes of small denomination U.S. banknotes being sent from Mexican casas de cambio 
to their U.S. accounts via armored transport or sold directly to U.S. banks. These sales or 
exchanges may involve jurisdictions outside of Mexico. 

• Casas de cambio direct the remittance of funds via multiple funds transfers to jurisdictions 
outside of Mexico that bear no apparent business relationship with the casas de cambio. Funds 
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transfer recipients may include individuals, businesses, and other entities in free trade zones. 

• Casas de cambio deposit numerous third-party items, including sequentially numbered 
monetary instruments, to their accounts at U.S. banks. 

• Casas de cambio direct the remittance of funds transfers from their accounts at Mexican 
financial institutions to accounts at U.S. banks. These funds transfers follow the deposit of 
currency and third-party items by the casas de cambio into their Mexican financial institution. 

Bulk Currency Shipments 

• An increase in the sale of large denomination U.S. bank notes to foreign financial institutions 
by U.S. banks. 

• Large volumes of small denomination U.S. bank notes being sent from foreign nonbank 
financial institutions to their accounts in the United States via armored transport, or sold 
directly to U.S. banks. 

• Multiple wire transfers initiated by foreign nonbank financial institutions that direct U.S. banks 
to remit funds to other jurisdictions that bear no apparent business relationship with that 
foreign nonbank financial institution. Recipients may include individuals, businesses, and other 
entities in free trade zones and other locations. 

• The exchange of small denomination U.S. bank notes for large denomination U.S. bank notes 
that may be sent to foreign countries. 

• Deposits by foreign nonbank financial institutions to their accounts at U.S. banks that include 
third-party items, including sequentially numbered monetary instruments. 

• Deposits of currency and third-party items by foreign nonbank financial institutions to their 
accounts at foreign financial institutions and thereafter direct wire transfers to the foreign 
nonbank financial institution's accounts at U.S. banks. 

Trade Finance 


• Items shipped that are inconsistent with the nature of the customer's business (e.g., a steel 
company that starts dealing in paper products, or an information technology company that 
starts dealing in bulk pharmaceuticals). 

• Customers conducting business in higher-risk jurisdictions. 

• Customers shipping items through higher-risk jurisdictions, including transit through 
noncooperative countries. 

• Customers involved in potentially higher-risk activities, including activities that may be 
subject to export/import restrictions (e.g., equipment for military or police organizations of 
foreign governments, weapons, ammunition, chemical mixtures, classified defense articles, 
sensitive technical data, nuclear materials, precious gems, or certain natural resources such 
as metals, ore, and crude oil). 

• Obvious over- or under-pricing of goods and services. 

• Obvious misrepresentation of quantity or type of goods imported or exported. 

• Transaction structure appears unnecessarily complex and designed to obscure the true nature 
of the transaction. 

• Customer requests payment of proceeds to an unrelated third party. 

• Shipment locations or description of goods not consistent with letter of credit. 

• Significantly amended letters of credit without reasonable justification or changes to the 
beneficiary or location of payment. Any changes in the names of parties should prompt 
additional OFAC review. 

Privately Owned Automated Teller Machines 

• Automated teller machine (ATM) activity levels are high in comparison with other privately 
owned or bank-owned ATMs in comparable geographic and demographic locations. 

• Sources of currency for the ATM cannot be identified or confirmed through withdrawals from 
account, armored car contracts, lending arrangements, or other appropriate documentation. 
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Insurance 


• A customer purchases products with termination features without concern for the product's 
investment performance. 

• A customer purchases insurance products using a single, large premium payment, particularly 
when payment is made through unusual methods such as currency or currency equivalents. 

• A customer purchases a product that appears outside the customer's normal range of financial 
wealth or estate planning needs. 

• A customer borrows against the cash surrender value of permanent life insurance policies, 
particularly when payments are made to apparently unrelated third parties. 

• Policies are purchased that allow for the transfer of beneficial ownership interests without the 
knowledge and consent of the insurance issuer. This would include secondhand endowment and 
bearer insurance policies. 

• A customer is known to purchase several insurance products and uses the proceeds from an 
early policy surrender to purchase other financial assets. 

• A customer uses multiple currency equivalents (e.g., cashier's checks and money orders) from 
different banks and money services businesses to make insurance policy or annuity payments. 

Shell Company Activity 

• A bank is unable to obtain sufficient information or information is unavailable to positively 
identify originators or beneficiaries of accounts or other banking activity (using Internet, 
commercial database searches, or direct inquiries to a respondent bank). 

• Payments to or from the company have no stated purpose, do not reference goods or services, 
or identify only a contract or invoice number. 

• Goods or services, if identified, do not match profile of company provided by respondent bank 
or character of the financial activity; a company references remarkably dissimilar goods and 
services in related funds transfers; explanation given by foreign respondent bank is 
inconsistent with observed funds transfer activity. 

• Transacting businesses share the same address, provide only a registered agent's address, or 
have other address inconsistencies. 

• Unusually large number and variety of beneficiaries are receiving funds transfers from one 
company. 

• Frequent involvement of multiple jurisdictions or beneficiaries located in higher-risk offshore 
financial centers. 

• A foreign correspondent bank exceeds the expected volume in its client profile for funds 
transfers, or an individual company exhibits a high volume and pattern of funds transfers that 
is inconsistent with its normal business activity. 

• Multiple high-value payments or transfers between shell companies with no apparent 
legitimate business purpose. 

• Purpose of the shell company is unknown or unclear. 

Embassy. Forei g n Consulate, and Forei g n Mission Accounts 

• Official embassy business is conducted through personal accounts. 

• Account activity is not consistent with the purpose of the account, such as pouch activity or 
payable upon proper identification transactions. 

• Accounts are funded through substantial currency transactions. 

• Accounts directly fund personal expenses of foreign nationals without appropriate controls, 
including, but not limited to, expenses for college students. 


Employees 


• Employee exhibits a lavish lifestyle that cannot be supported by his or her salary. 
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• Employee fails to conform to recognized policies, procedures, and processes, particularly in 
private banking. 

• Employee is reluctant to take a vacation. 

• Employee overrides a hold placed on an account identified as suspicious so that transactions 
can occur in the account. 

Other Unusual or Suspicious Customer Activity 

• Customer frequently exchanges small-dollar denominations for large-dollar denominations. 

• Customer frequently deposits currency wrapped in currency straps or currency wrapped in 
rubber bands that is disorganized and does not balance when counted. 

• Customer purchases a number of cashier's checks, money orders, or traveler's checks for large 
amounts under a specified threshold. 

• Customer purchases a number of open-end prepaid cards for large amounts. Purchases of 
prepaid cards are not commensurate with normal business activities. 

• Customer receives large and frequent deposits from online payments systems yet has no 
apparent online or auction business. 

• Monetary instruments deposited by mail are numbered sequentially or have unusual symbols 
or stamps on them. 

• Suspicious movements of funds occur from one bank to another, and then funds are moved 
back to the first bank. 

• Deposits are structured through multiple branches of the same bank or by groups of people 
who enter a single branch at the same time. 

• Currency is deposited or withdrawn in amounts just below identification or reporting 
thresholds. 

• Customer visits a safe deposit box or uses a safe custody account on an unusually frequent 
basis. 

• Safe deposit boxes or safe custody accounts opened by individuals who do not reside or work 
in the institution's service area, despite the availability of such services at an institution closer 
to them. 

• Customer repeatedly uses a bank or branch location that is geographically distant from the 
customer's home or office without sufficient business purpose. 

• Customer exhibits unusual traffic patterns in the safe deposit box area or unusual use of safe 
custody accounts. For example, several individuals arrive together, enter frequently, or carry 
bags or other containers that could conceal large amounts of currency, monetary instruments, 
or small valuable items. 

• Customer rents multiple safe deposit boxes to store large amounts of currency, monetary 
instruments, or high-value assets awaiting conversion to currency, for placement into the 
banking system. Similarly, a customer establishes multiple safe custody accounts to park large 
amounts of securities awaiting sale and conversion into currency, monetary instruments, 
outgoing funds transfers, or a combination thereof, for placement into the banking system. 

• Unusual use of trust funds in business transactions or other financial activity. 

• Customer uses a personal account for business purposes. 

• Customer has established multiple accounts in various corporate or individual names that lack 
sufficient business purpose for the account complexities or appear to be an effort to hide the 
beneficial ownership from the bank. 

• Customer makes multiple and frequent currency deposits to various accounts that are 
purportedly unrelated. 

• Customer conducts large deposits and withdrawals during a short time period after opening 
and then subsequently closes the account or the account becomes dormant. Conversely, an 
account with little activity may suddenly experience large deposit and withdrawal activity. 

• Customer makes high-value transactions not commensurate with the customer's known 
incomes. 

Potentially Suspicious Activity That May Indicate Terrorist Financing 

The following examples of potentially suspicious activity that may indicate terrorist financing are 

primarily based on guidance "Guidance for Financial Institutions in 
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Detecting Terrorist Financing" provided by the FATF. 303 FATF is an intergovernmental body whose 
purpose is the development and promotion of policies, both at national and international levels, to 
combat money laundering and terrorist financing. 

Activity Inconsistent With the Customer's Business 

• Funds are generated by a business owned by persons of the same origin or by a business that 
involves persons of the same origin from higher-risk countries (e.g., countries designated by 
national authorities and FATF as noncooperative countries and territories). 

• The stated occupation of the customer is not commensurate with the type or level of activity. 

• Persons involved in currency transactions share an address or phone number, particularly 
when the address is also a business location or does not seem to correspond to the stated 
occupation (e.g., student, unemployed, or self-employed). 

• Regarding nonprofit or charitable organizations, financial transactions occur for which there 
appears to be no logical economic purpose or in which there appears to be no link between the 
stated activity of the organization and the other parties in the transaction. 

• A safe deposit box opened on behalf of a commercial entity when the business activity of the 
customer is unknown or such activity does not appear to justify the use of a safe deposit box. 

Funds Transfers 

• A large number of incoming or outgoing funds transfers take place through a business 
account, and there appears to be no logical business or other economic purpose for the 
transfers, particularly when this activity involves higher-risk locations. 

• Funds transfers are ordered in small amounts in an apparent effort to avoid triggering 
identification or reporting requirements. 

• Funds transfers do not include information on the originator, or the person on whose behalf 
the transaction is conducted, when the inclusion of such information would be expected. 

• Multiple personal and business accounts or the accounts of nonprofit organizations or charities 
are used to collect and funnel funds to a small number of foreign beneficiaries. 

• Foreign exchange transactions are performed on behalf of a customer by a third party, 
followed by funds transfers to locations having no apparent business connection with the 
customer or to higher-risk countries. 

Other Transactions That Appear Unusual or Suspicious 

• Transactions involving foreign currency exchanges are followed within a short time by funds 
transfers to higher-risk locations. 

• Multiple accounts are used to collect and funnel funds to a small number of foreign 
beneficiaries, both persons and businesses, particularly in higher-risk locations. 

• A customer obtains a credit instrument or engages in commercial financial transactions 
involving the movement of funds to or from higher-risk locations when there appear to be no 
logical business reasons for dealing with those locations. 

• Banks from higher-risk locations open accounts. 

• Funds are sent or received via international transfers from or to higher-risk locations. 

• Insurance policy loans or policy surrender values that are subject to a substantial surrender 
charge. 
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